How to Verify Contractor Interfaces Before a SIMOPS Shutdown: 9 Decision Gates

F2 risk-management guide for shutdown managers, contractor coordinators, and operations leaders

A shutdown plan can be technically complete and still fail at the boundary between work packages. The electrical contractor assumes the area is isolated, the mechanical crew assumes access remains open, and operations assumes both teams will stop when conditions change. SIMOPS becomes dangerous when those assumptions are not converted into decisions that someone can verify.

This guide shows how to verify contractor interfaces before simultaneous work begins. It is not a document checklist. It is a decision sequence that tests whether the people who share an operating space understand the same boundaries, controls, escalation route, and stop-work conditions.

What you need before starting

Start with the work packages, the operating state, and the interface map, because a contractor review cannot test dependencies that have not been made visible.

Collect the shutdown schedule, work scopes, plot plan, isolation register, permit matrix, lifting and access plans, emergency arrangements, and contractor contact list. Mark the activities that can change energy, occupancy, access, ventilation, fire protection, traffic, or emergency egress. ISO 31000:2018 supports this context-first approach because risk criteria depend on the environment in which the work will occur.

Invite the operations authority, shutdown manager, contractor supervisors, permit coordinator, maintenance representative, and emergency lead. The purpose is not to make everyone approve every detail. The purpose is to expose the decisions that cross organizational boundaries.

Step 1: Map the shared operating space

Draw the physical and operational boundaries that more than one crew will rely on during the shutdown.

Mark work fronts, laydown areas, access routes, exclusion zones, isolation points, temporary services, lifting paths, muster routes, and emergency access. Include areas that appear empty but may be needed for escape, rescue, or equipment movement.

Then compare the map with the schedule. A boundary that is safe at 07:00 may be occupied, barricaded, energized, or inaccessible at 15:00. The verification is complete only when the map reflects the sequence of work, not merely the final shutdown layout.

Step 2: List every interface that can change exposure

Identify the interactions that can transfer energy, access, responsibility, or uncertainty between work packages.

Write the interface as a condition and an effect. For example, “scaffold removal changes access to the valve bay,” or “temporary power isolation affects the ventilation assumed by the coating crew.” This phrasing is stronger than a generic label such as “contractor coordination,” because it makes the possible change visible.

Include interfaces involving operations, contractors, logistics, security, occupational hygiene, emergency response, and inspection. If a crew needs another team to create, maintain, or release a condition, record the dependency instead of treating it as routine cooperation.

Step 3: Assign one control owner to each interface

Give every critical interface one accountable owner who can authorize, pause, or escalate the related decision.

The owner is not necessarily the person performing the task. A contractor supervisor may own execution, while the host operations authority owns the plant state and the shutdown manager owns the conflict decision. Record those roles separately so that responsibility for action does not get confused with authority to change the operating condition.

Test the assignment with a direct question: “Who can stop both work packages when this interface becomes unsafe?” If the answer is a committee, a shared inbox, or “the person on shift,” the interface still lacks a usable decision route.

Step 4: Define the boundary condition that must remain true

State the condition that makes the interface acceptable and the observable evidence that proves it still exists.

A control boundary should be specific enough to inspect. “Area controlled” is weak. “The north access route remains clear from the compressor pad to the emergency gate, with the route checked at each shift handover” gives the team something to verify.

Use the same logic for isolations, gas testing, fire protection, lifting zones, temporary structures, ventilation, and simultaneous permits. If the condition cannot be observed, measured, or confirmed by a named person, it is an assumption rather than a control.

Step 5: Reconcile permits and work-package assumptions

Compare the assumptions inside each permit with the conditions created by every adjacent task.

Review the permits together rather than one at a time. Check energy states, simultaneous occupancy, line opening, hot work, confined-space entry, lifting, temporary removal of protection, chemical exposure, and emergency access. A permit may be correct in isolation while becoming incompatible with another approved activity.

Ask each supervisor to identify the condition their team needs from someone else. Then ask the other team to show where that condition is controlled. This two-way test turns coordination language into evidence and reveals gaps that a signature sequence can hide.

Step 6: Test the communication and escalation route

Verify how a worker reports an interface change, who receives it, and how quickly work can be paused.

Use a realistic change, such as a delayed isolation, a blocked route, a failed gas test, a crane arriving late, or a weather change that affects access. Have the supervisors explain the first call, the decision authority, the message that must be repeated to the crews, and the record that confirms the decision.

A communication plan is incomplete when it names radios and phone numbers but not authority. The team needs a route that remains usable during shift changes, contractor turnover, and pressure to recover schedule.

Step 7: Run a boundary-change rehearsal

Change one critical assumption and watch whether the work plan produces a clear, safe response.

Move a barricade, remove a temporary utility, delay a handover, make an exclusion zone smaller, or place an adjacent job one hour behind schedule. Do not turn the exercise into a theatrical emergency drill. The aim is to test whether the interface owner knows which work stops, which work may continue, and what evidence is needed before restarting.

The rehearsal should expose hidden coupling. If one contractor cannot continue without another contractor’s control, the dependency belongs in the plan, the schedule, and the daily coordination meeting.

Step 8: Verify field evidence before mobilization

Walk the shared area and confirm that the controls described in the review exist in the condition the crews will actually encounter.

Check signs, barriers, access, isolation points, lighting, ventilation, fire protection, rescue equipment, temporary services, housekeeping, and the location of interface information. Ask workers to point out the boundary that affects their task and the person they would contact if it changed.

Field verification matters because a drawing can show separation that the worksite has already lost. A control that exists only in the shutdown pack has not yet protected anyone.

Step 9: Release, restrict, or stop the simultaneous work

Make the shutdown decision from verified interface evidence, not from the cost of delaying a contractor.

Release the work when the critical interfaces have named owners, visible boundary conditions, compatible permits, working communication, and a tested response to change. Restrict the scope when only part of the interface map is ready. Stop the work when a critical dependency remains ambiguous or when the required condition cannot be maintained.

Record what was verified, what remains unresolved, who owns the next decision, and which event triggers a new review. This creates a traceable line between readiness and assumption, which is especially important when a shutdown crosses shifts, contractors, and operating states.

Final checklist for SIMOPS interface readiness

SIMOPS is ready when the shared worksite has shared boundaries, named decision owners, and controls that can be checked in the field.

• The shared operating space and time-dependent boundaries are mapped.
• Every interface that can change exposure is described as a condition and effect.
• Each critical interface has one accountable control owner and one escalation route.
• Boundary conditions are observable, measurable, or confirmable in the field.
• Permits have been reconciled against adjacent work packages and plant states.
• A realistic change scenario has been rehearsed before mobilization.
• Field evidence matches the shutdown plan, including access and emergency routes.
• Release, restriction, and stop-work criteria are recorded and understood by supervisors.

In *The Illusion of Compliance*, Andreza Araujo argues that formal completion is not the same as controlled work. SIMOPS makes that distinction visible. A shutdown is ready when contractors can explain the boundaries they depend on, the controls they must preserve, and the authority that can stop the work when reality no longer matches the plan.

If your organization needs to strengthen contractor governance before complex work begins, Andreza Araujo helps leaders connect risk management, safety culture, and practical execution.